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FOREWORD 


This Indian Standard (Part 2/Sec 21) (Second Revision) was adopted by the Bureau of Indian Standards, after the 
draft finalized by the Electrical Appliances Sectional Committee had been approved by the Electrotechnical 
Division Council. 


This standard was first published in 1992, and revised in 2011. This revision has been undertaken primarily to 
align the existing standard with the latest International Standard. 


This standard covers the safety requirements of stationary storage type electric water heaters. This standard however 
does not cover the performance requirements which are covered under IS 2082 ‘Stationary storage type electric 
water heater’. 


It has been assumed in the formulation of this standard that the execution of its provisions is entrusted to 
appropriately qualified and experienced persons. 


This standard recognizes the internationally accepted level of protection against hazards such as electrical, 
mechanical, thermal, fire and radiation of appliances when operated as in normal use taking into account the 
manufacturer’s instructions. It also covers abnormal situations that can be expected in practice and takes into 
account the way in which electromagnetic phenomena can affect the safe operation of appliances. 


This standard takes into account the requirements of IS 732 : 2018 ‘Code of practice for Electrical Wiring 
Installations (fourth revision), as far as possible so that there is compatibility with the wiring rules when the 
appliance is connected to the supply mains. However, in case of any deviation, wiring rules take precedence. 


If an appliance within the scope of this standard also incorporates functions that are covered by another Part 2 of 
IS 302, the relevant Part 2 is applied to each function separately, as far as is reasonable. If applicable, the influence 
of one function on the other is taken into account. 


When a Part 2 standard does not include additional requirements to cover hazards dealt with in Part 1, Part 1 
applies. 


NOTE — This means that in such a case, it has been decided that for the Part 2 standards that it is not necessary to specify particular 
requirements for the appliance in question over and above the general requirements. 


This standard is a product family standard dealing with the safety of appliances and takes precedence over horizontal 
and generic standards covering the same subject. 


NOTE — Horizontal and generic standards covering a hazard are not applicable since they have been taken into consideration when 
developing the general and particular requirements for the IS 302 series of standards. 


An appliance that complies with the text of this standard will not necessarily be considered to comply with the 
safety principles of the standard if, when examined and tested, it is found to have other features which impair the 
level of safety covered by these requirements. 


An appliance employing materials or having forms of construction differing from those detailed in the requirements 
of this standard may be examined and tested according to the intent of the requirements and, if found to be 
substantially equivalent, may be considered to comply with the standard. 


This standard is to be read in conjunction with the latest edition of IS 302-1 ‘Safety of household and similar 
electrical appliances : Part 1 General Requirements’ and its amendments. 


NOTE — When Part | is mentioned in this standard, it refers to IS 302-1. 


This Part 2 supplements or modifies the corresponding clauses in IS 302-1, so as to convert that standard into the 
Indian standard: Particular requirements for Stationary Storage Type Electric Water Heaters . 


(Continued on third cover) 
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Indian Standard 


SAFETY OF HOUSEHOLD AND SIMILAR 


ELECTRICAL APPLIANCES 


PART 2 PARTICULAR REQUIREMENTS 
Section 21 Stationary Storage Type Electric Water Heaters 


(Second Revision) 


1 SCOPE 
This clause of Part 1 is replaced by the following. 


This Indian standard deals with the safety of electric 
storage water heaters for household and similar 
purposes and intended for heating water below boiling 
temperature, their rated voltage being not more than 
250 V for single-phase appliances and 480 V for other 
appliances. 


Appliances not intended for normal household use but 
which nevertheless may be a source of danger to the 
public, such as appliances intended to be used by 
laymen in shops, in light industry and on farms, are 
within the scope of this standard. 


This standard is also applicable to immersion heater 
units intended to be retrofitted in a heat exchange closed 
water heater having provision for retrofitting. Such a 
unit shall comply with the requirements in Annex AA. 

NOTE — Australia, Netherlands and New Zealand do not allow 


immersion heater units intended to be retrofitted in a heat 
exchange closed water heater unless; 


a) the immersion heater unit has been tested with the tank 
models and brands listed in the instructions of the 
immersion heater unit; and 


b) the tank models and brands list the models of the 
immersion heater units that can be retrofitted. 
As far as is practicable, this standard deals with the 
common hazards presented by appliances that are 
encountered by all persons in and around the home. 
However, in general, it does not take into account, 


a) persons (including children) whose 
1. physical, sensory or mental capabilities; or 
2. lack of experience and knowledge 
prevents them from using the appliance 
safely without supervision or instruction; 

b) children playing with the appliance, 

NOTE 101 Attention is drawn to the fact that 

a) for appliances intended to be used in vehicles or on board 
ships or aircraft, additional requirements may be necessary; 


b) in many countries additional requirements are specified by 
the national health authorities, the national authorities 
responsible for the protection of labour and similar authorities; 


c) in many countries regulations exist for the installation of 
equipment connected to the water mains. 


NOTE 102 — This standard does not apply to 


a) appliances for boiling water (IS 302-2-15); 
b) instantaneous water heaters (IS 302-2-35); 


c) commercial dispensing appliances and vending machines 
(IS 302-2-75 (under preparation)); 


d) appliances intended exclusively for industrial purposes; 


e) appliances intended to be used in locations where special 
conditions prevail, such as the presence of a corrosive or 
explosive atmosphere (dust, vapour or gas). 


2 REFERENCES 


This clause of Part 1 is applicable except as follows: 


Addition 
IS No. Title 
191 : 2007 Copper (fourth revision) 
1570 (Part 5): Schedule for wrought steels: Part 5 
1985 Stainless and heat resisting steels 


(second revision) 

Safety of household and similar 
electrical appliances: Part 1 General 
requirements. 

Automatic electric controls for 
household and similar use: Part 1 
General requirements. 

Functional safety of electrical/ 
electronic/programmable electronics 
safety releated systems : Part 7 
Overview of techniques & measures. 
Methods of test for vitreous 


302-1 (Part 1) : 
2008 


IS/IEC 60730-1 : 
1999 


IS/IEC 61508-7 : 
2000 


3972 (Part 2/ 


Sec 2): 1985 enamelware: Part 2 Test methods, 
Section 2 Low and high voltage tests 
for detecting and locating defects 
(first revision) 

13273 : 1991 Vitreous enamelled inner tanks for 


storage water heaters 
3 TERM AND DEFINITIONS 


This clause of Part 1 is applicable except as follows. 


3.1.9 Replacement: 


normal operation 
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operation of the appliance after installation in 
accordance with the instructions and filled with cold 
water 


3.101 storage water heater 


stationary appliance for heating and storing water in a 
container and incorporating devices to control the water 
temperature 


3.102 closed water heater 


unvented storage water heater intended to operate at 
the pressure of the water system, the flow of water being 
controlled by one or more valves in the outlet system 


NOTES 
1 A closed water heater is shown in Figure 101a. 


2 The operating pressure may be the output pressure of a 
reducing or boosting device. 


3.103 cistern-fed water heater 


storage water heater that is vented to atmosphere and 
intended to be supplied by water under gravity from a 
separate cistern, the flow of water being controlled by 
one or more valves in the outlet system 


NOTES 
1 A cistern-fed water heater is shown in Figure 101d. 


2 The water heater may be installed so that the expanded water 
returns to the cistern. 


3 In a cistern-fed water heater, the pressure in the container 
results from the column of water in the cistern. 


3.104 cistern-type water heater 


storage water heater having a container supplied by 
water under gravity from a cistern incorporated in the 
appliance. 


NOTES 


1 The expanded water can return to the cistern, the flow of 
water being controlled by one or more valves in the outlet system 


2 A cistern-type water heater is shown in Figure 101c. 
3 Ina cistern-type water heater, the surface of the water is always 
at atmospheric pressure. 


3.105 open-outlet water heater 


storage water heater in which the flow of water is only 
controlled by a valve in the inlet pipe and in which the 
expanded or displaced water flows through the outlet 


NOTES 
1 An open-outlet water heater is shown in Figure 101b. 


2 In an open-outlet water heater, the static pressure at the outlet 
is always at atmospheric pressure. 


3.106 low-pressure water heater 


storage water heater that is vented to atmosphere and 
intended to be connected to the water mains through a 
pressure reducing valve, the flow of water being 
controlled by one or more valves in the outlet system 


NOTE — A low-pressure water heater is shown in Figure 101e. 


3.107 rated pressure 


water pressure assigned to the appliance by the 
manufacturer 


3.108 heat exchange water heater 


storage water heater in which heated water is fed into a 
heat exchanger, such as a coiled tube or similar device, 
which is itself immersed in a container with the water 
to be heated. 


NOTES 


1 The heated water fed into the heat exchanger is heated from a 
primary heat source such as a solar panel or heat pump. 


2 A heat exchange water heater is shown in Figure 101f. 


4 GENERAL REQUIRMENTS 
This clause of Part 1 is applicable. 


5 GENERAL CONDITIONS FOR THE TESTS 
This clause of Part 1 is applicable except as follows. 


5.2 Addition: 


NOTE 101 Additional appliances can be required if damage 
occurs during the tests of 19.2 or 19.3. 


5.3 Addition: 


When the tests are carried out on a single appliance, 
the tests of 22.47, 22.102, 22.103, and 24.102 are 
carried out before the tests of 19. 


6 CLASSIFICATION 


This clause of Part 1 is applicable except as follows. 


6.1 Modification: 


Water heaters shall be class I, class II or class III. 


6.2 Addition: 


Water heaters for installation outdoors shall be at least 
IPX4. Other water heaters shall be at least IPX1. 


7 MARKING AND INSTRUCTIONS 


This clause of Part 1 is applicable except as follows. 


7.1 Addition: 


Appliances, other than cistern-type water heaters, shall 
be marked with the rated pressure in pascals. 


Appliances shall be marked with the rated capacity in 
litres. 


Closed water heaters shall be marked with a statement 
that a pressure-relief device is to be fitted in the 
installation, unless it is incorporated in the appliance. 


Closed water heaters having a rated pressure less than 
0.6 MPa and low-pressure water heaters shall be 


marked with a statement that a pressure reducing valve 
is to be fitted in the installation. 


Open-outlet water heaters shall be marked, close to the 
outlet connection or on a tag attached to the appliance, 
with the substance of the following: 


WARNING: This outlet acts as a vent and 
must only be connected to a fitting 
recommended by the manufacturer. It must not 
be connected to a tap. 


7.12 Addition: 


The instructions for closed water heaters shall state the 
substance of the following: 


a) the water may drip from the discharge pipe of 
the pressure-relief device and that this pipe 
must be left open to the atmosphere; 

b) the pressure-relief device is to be operated 
regularly to remove lime deposits and to verify 
that it is not blocked; 


c) how the water heater can be drained. 


7.12.1 Addition: 


The installation instructions shall state the substance 
of the following: 


a) the type or characteristics of the pressure-relief 
device and how to connect it, unless it is 
incorporated in the appliance; 

b) a discharge pipe connected to the pressure- 
relief device is to be installed in a continuously 
downward direction and in a frost-free 
environment; 

c) the type or characteristics of a pressure 
reducing valve and the installation details (for 
appliances having a rated pressure less than 
0.6 MPa). 


The instructions for closed water heaters incorporating 
a heat exchanger shall give details on the installation 
of control devices and the temperature settings that are 
necessary to prevent operation of the thermal cut-out 
caused by the heat from the exchanger. 


The instructions for cistern-fed water heaters and low- 
pressure water heaters shall contain the substance of 
the following: 


WARNING: Do not connect any pressure-relief 
device to the vent pipe of this water heater. 


7.101 The water inlet and the water outlet shall be 
identified. This identification shall not be on detachable 
parts. If colours are used, blue shall be used for the 
inlet and red for the outlet. An alternative means of 
identification may be by means of arrows showing the 
direction of the water flow. 
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Compliance is checked by inspection. 


8 PROTECTION AGAINST ACCESS TO LIVE 
PARTS 


This clause of Part 1 is applicable. 


9 STARTING OF MOTOR OPERATED 
APPLIANCES 


This clause of Part 1 is not applicable. 


10 POWER INPUT AND CURRENT 
This clause of Part 1 is applicable. 


11 HEATING 


This clause of Part 1 is applicable except as follows. 


11.7 Replacement: 


The appliance is operated until steady conditions are 
established or until the thermostat interrupts the current 
for the first time after 16 h, whichever is shorter. 


12 VOID 


13 LEAKAGE CURRENT AND ELECTRIC 
STRENGTH AT OPERATING TEMPRETURE 


This clause of Part 1 is applicable. 


14 TRANSIENT OVER VOLTAGES 
This clause of Part 1 is applicable. 


15 MOISTURE RESISTANCE 


This clause of Part 1 is applicable except as follows. 


15.2 Addition: 


The test is only applicable to cistern-type water heaters. 


15.3 Addition: 


NOTE 101— If the appliance is too large for the humidity 
cabinet, the test can be carried out on those parts that contain 
electrical components. 


16 LEAKAGE CURRENT AND ELECTRIC 
STRENGTH 


This clause of Part 1 is applicable. 


17 OVERLOAD PROTECTION OF 
TRANSFORMEFS AND ASSOCIATED CIRCUITS 


This clause of Part 1 is applicable. 
18 ENDURANCE 
This clause of Part 1 is not applicable. 


19 ABNORMAL OPERATION 


This clause of Part 1 is applicable except as follows. 
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19.1 Modification: 


Instead of the tests specified for appliances 
incorporating heating elements, the following applies. 


For closed water heaters, low-pressure water heaters 
and open-outlet water heaters, compliance is checked 
by the tests of 19.2, 19.3 and 19.4 if applicable. 
However, 19.101 applies instead for appliances not 
liable to be emptied in normal use and having all four 
of the following features: 


a) An outer enclosure of metal or a water 
container of metal and an outer enclosure of 
non-metallic material; 

NOTE 101 — Non-metallic covers can be used for the supply 
terminals and controls. 


b) Non-combustible thermal insulation; 

NOTE 102 — Insulation withstanding the needle flame test of 
Annex E is considered to be non-combustible. 

1) a capacity exceeding 30 l; 

2) arated power input not exceeding 6 kW. 
NOTE 103 Appliances are not considered liable to be emptied 
in normal use if emptying through the inlet is prevented by a 
check valve, a pipe interrupter or an air gap. These devices can 
be fitted in the inlet pipe in accordance with the instructions. 
Emptying through openings provided for servicing purposes 
only is not considered to be normal use. 


NOTE 104— Cistern-fed water heaters and cistern-type water 
heaters are not subjected to the tests. 


19.2 Addition: 

The appliance is operated empty, any thermal control 

that operates during the test of 11 being short-circuited. 
NOTE 101— If the appliance is provided with more than one 


thermal control, these are short-circuited in turn. 


19.3 Addition: 


NOTE 101— If the water heater has been damaged during the 
previous test, a new appliance is used. 


19.4 Replacement: 

For open-outlet water heaters, the test of 19.2 is 
repeated but with the container filled with water to a 
level at least 10 mm above the highest point of the 


heating element. The appliance is operated at 1.15 times 
rated power input under normal operation. 


NOTE 101— If the water heater has been damaged during 
previous tests, a new appliance is used. 


19.13 Addition: 


There shall be no leakage from the container during 
the tests. 


19.101 The appliance is tested for 24 h under the 
conditions specified in 11 but with the container empty. 


20 STABILITY AND MECHANICAL HAZARDS 
This clause of Part 1 is applicable. 


21 MECHANICAL STRENGTH 
This clause of Part 1 is applicable. 


22 CONSTRUCTION 


This clause of Part 1 is applicable except as follows. 


22.6 Addition: 


The enclosure shall have a drain hole positioned so 
that the water can drain without impairing electrical 
insulation, unless condensed water cannot accumulate 
within the enclosure in normal use. The hole shall be at 
least 5 mm in diameter or 20 mm? in area with a width 
of at least 3 mm. 


Compliance is checked by inspection and measurement. 


22.20 Addition: 


Thermal insulation shall not be used for basic insulation 
of internal wiring. 


22.47 Replacement: 


Appliances shall withstand the water pressure occurring 
in normal use. 


Compliance is checked by subjecting the appliance to 
a water pressure of, 


a) twice the rated pressure, for closed water 
heaters. If the water heater is supplied through 
a pressure reducing valve, the container is 
subjected to twice the working pressure instead; 


NOTES 

1 The pressure reducing valve can be incorporated in the water- 
inlet pipe. 

2 The working pressure is the maximum pressure in the 
container measured during the test of 11. 


b) 1.5 times rated pressure, for cistern-fed water 
heaters and low-pressure water heaters; 

c) 0.15 MPa, for open-outlet water heaters; 

d) 0.03 MPa, for cistern-type water heaters. 


Pressure-relief devices are rendered inoperative. The 
pressure is raised at a rate of 0.13 MPa/s to the specified 
value and is maintained at that value for 15 min. 


Water shall not leak from the appliance and there shall 
be no permanent deformation to such an extent that 
compliance with this standard is impaired. 
NOTE 3 — Heat exchangers incorporated in an appliance are 
subjected to a pressure test based on their working pressure. 


NOTE 4 — Damage to a protective coating on the inside of 
containers is not considered to be a hazard. 


22.101 The rated pressure of closed water heaters 
intended for direct connection to the water main shall 
be at least 0.6 MPa. 


The rated pressure of closed water heaters and low- 
pressure water heaters, intended to be supplied by a 


pressure reducing valve that is not incorporated in the 
appliance, shall be at least 0.1 MPa. 


The rated pressure of cistern-fed water heaters shall 
not exceed 0.2 MPa. 


NOTE — The rated pressure of open-outlet water heaters 
is 0 Pa. 


Compliance is checked by inspection. 


22.102 Closed water heaters shall be constructed so 
that repeated drawing off does not cause the water to 
boil. 


Compliance is checked by the following test. 
The appliance is operated as specified in 11. 


When the thermostat has operated for the first time, 
water is drawn off at a rate of approximately 2 l/min or 
10 percent of the capacity of the appliance per minute, 
whichever is less, until the thermostat switches on again. 


When the thermostat next operates, water is drawn off 
again at the same rate until the thermostat switches on, 
this sequence being repeated until steady conditions 
are established. 


The temperature of the water, measured by means of a 
thermocouple at the outlet, shall not exceed 98°C. 


22.103 Pressure-relief devices of closed water heaters 
shall prevent the pressure in the container from 
exceeding the rated pressure by more than 0.1 MPa. 


Compliance is checked by subjecting the container to 
a slowly increasing water pressure. 


NOTE —The pressure-relief device can be fitted during 
installation. 


22.104 The outlet of open-outlet water heaters shall be 
constructed so that the water flow is not limited to such 
an extent that the container is subjected to a significant 
pressure. 


NOTE — This requirement is considered to be met if the cross- 
sectional area of the water outlet is not less than that of the 
inlet. 


The vent pipe of low pressure water heaters shall have 
an internal diameter of at least 20 mm. 


Compliance is checked by inspection and measurement. 


22.105 Cistern-type water heaters shall be constructed 
so that the container is always at atmospheric pressure 
by means of a vent having an area of at least 30 mm? 
and a minimum dimension of at least 3 mm. 


Compliance is checked by inspection and by 
measurement. 


22.106 Water heaters shall incorporate a thermal cut- 
out providing all-pole disconnection and which operates 
independently from the thermostat. However, for 
appliances intended to be connected to fixed wiring, 
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the neutral conductor need not be disconnected. 
Compliance is checked by inspection. 


22.107 Heating elements and thermal control sensors 
in contact with the outer surface of the container shall 
be held in position securely. 


Compliance is checked by inspection. 


22.108 Appliances for wall mounting shall have reliable 
provision for fixing to a wall, independent of the 
connection to the water mains. 


Compliance is checked by inspection. 


22.109 Appliances having a capacity of more than 15 1 
that cannot be emptied through a drain fitted in the water 
pipes shall incorporate means for draining that requires 
a tool for its operation. 


Compliance is checked by inspection and by manual 
test. 


NOTES 


1 Residual water in the container below the end of the inlet 
pipe is disregarded. 


2 The means for draining can be combined with a pressure- 
relief valve. 


22.110 Closed water heaters incorporating a heat 
exchanger shall be constructed so that during normal 
use the thermal cut-out does not operate due to heat 
from the exchanger. 


Thermostatic valves, by-pass valves and similar 
controlling devices used for this purpose shall be 
supplied with the appliance. 


Compliance is checked by inspection. 


The material of the inner container in water heaters 
other than open outlet water heaters and feed cistern in 
cistern type shall be of copper of purity not less than 
99.8 percent as per IS 191. In addition the inner 
container can be made of stainless steel. Stainless steel 
of Grades 304, 304L, 316, 316L of IS 1570 (Part 5) is 
recommended for this purpose. The apparatus plates 
and all bosses for screwed connection shall be, made 
of gunmetal, brass of brazing quality or stainless steel. 
All pipes shall be of copper, brass or stainless steel. 


The vitreous enamelled inner tank conforming to 
IS 13273 may also be used. However, the cathodic 
protection shall be provided for enamel inner container 
if complete coverage of enamel is not ensured within 
the limits of relevant Indian Standard. In case, cathodic 
protection is not provided in that case, inner container 
shall be subjected to high voltage test as laid down in 
IS 3972 (Part 2/Sec 2). 


22.111 Water heaters shall be resistant to vacuum 
impulses which may occur in normal use. Compliance 
is checked by subjecting containers to a vacuum of 
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66 kPa (0.66 bar) for 1 min. After the test, the container 
shall show no deformation which might result in hazard. 
Anti vacuum valves, if any, are not rendered 
inoperative. 


NOTE — The test may be made on a separate container. 


23 INTERNAL WIRING 
This clause of Part 1 is applicable. 


24 COMPONENTS 


This clause of Part 1 is applicable except as follows. 


24.1.4 Addition: 


Thermal cut-outs incorporated in closed water heaters 
shall comply with the requirements for Type 2.B 
controls in 13, 15, 16, 17 and 20 of IS/IEC 60730-1, 
unless they are tested with the appliance. 


24.101 Thermal cut-outs shall be non-self-resetting. 
They shall have a trip-free switching mechanism or be 
located so that they can only be reset after removal of a 
non-detachable cover. 


Compliance is checked by inspection. 


24.102 The operating temperature of the thermal cut- 
out of a closed water heater shall ensure that the water 
temperature cannot exceed 99°C or that the thermal 
cut-out operates before its temperature exceeds 130°C. 


Compliance is checked by the test of 24.102.1 for water 
temperatures not exceeding 99°C or by the test of 
24.102.2 for thermal cut-outs having an operating 
temperature up to 130°C. 


24.102.1 The appliance is operated under the conditions 
specified in 11 until the thermostat operates for the first 
time. A quantity of water equal to 25 per cent of the 
capacity of the container is then drawn off so that it is 
replaced by cold water. 


Immediately after the thermostat operates for the second 
time, it is short-circuited. The test is continued until 
the thermal cut-out operates. The outlet valve is then 
opened and the temperature of the water measured at 
the outlet. 


The temperature shall not exceed 99°C. 


If compliance relies on the operation of an electronic 
circuit, the test is repeated under the following 
conditions applied separately: 


the fault conditions a) to f) of 19.11.2 of Part 1 applied 
one at a time to the electronic circuit; 


the electromagnetic phenomena tests of 19.11.4.1 to 
19.11.4.7 of Part 1 applied to the appliance. 


The temperature of the water at the outlet shall not 


exceed 99°C during or after each of the tests. 


If the electronic circuit is programmable, the software 
shall contain measures to control the fault/ 
errorconditions specified in Table R.1 and is evaluated 
in accordance with the relevant requirements of 
Annex R. 


24.102.2 The operating temperature of the thermal cut- 
out is measured by means of a thermocouple positioned 
on its sensing element or as close as possible to it. 


The water temperature for appliances having vertically 
oriented metallic water containers is measured by a 
thermocouple attached to the outer surface of the upper 
dome. If the water container is horizontally oriented, 
two thermocouples are attached to the outer surface. 
The position of the thermocouple is shown in Fig. 102a. 


The water temperature for appliances having non- 
metallic water containers is measured at the most 
unfavourable position by a thermocouple positioned 
50 mm below the upper inner surface of the container, 
as shown in one of the diagrams of Fig. 102b. This 
method may also be used to measure the water 
temperature of appliances having metallic containers. 


The appliance is operated at 1.15 times rated power 
input under normal operation with the outlet valve 
closed and thermostats short-circuited. The test is 
continued until the thermal cut-out operates. 


The thermal cut-out shall operate before its temperature 
exceeds 110°C. The water temperature shall not exceed 
20 K of the maximum permitted operating temperature 
of the thermal cut-out. 


If compliance relies on the operation of an electronic 
circuit, the test is repeated under the following 
conditions applied separately: 


the fault conditions a) to f) of 19.11.2 of Part 1 applied 
one at a time to the electronic circuit; 


the electromagnetic phenomena tests of 19.11.4.2 and 
19.11.4.5 Part 1 applied to the appliance. 


The temperature of the water at the outlet shall not 
exceed 110 °C during or after each of the tests. 


25 SUPPLY CONNECTION AND EXTERNAL 
FLEXIBLE CORDS 


This clause of Part 1 is applicable except as follows. 
25.1 Modification: 


Appliances shall not incorporate an appliance inlet. 


26 TREMINALS 
CONDUCTORS 


FOR EXTERNAL 


This clause of Part 1 is applicable. 
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Key Type 
A heating element a Closed water heaters 
B container b Open-outlet water heater 
C expansion pipe c  Cistern-type water heater 
D overflow pipe d Cistern-fedwater heater 
E ball valve e Low-pressure water heat 
F water level f Heat Exchange water he: 
G cistern 
H vent pipe 


Fic. 101 EXAMPLE OF TYPES OF STORAGE WATER HEATERS 
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Key 
A container 
B external thermocouple 


Fic. 102A POSITION oF THERMOCOUPLES FOR METALLIC WATER CONTAINERS 


F 


ke ® ——ss 
| |e 
The thermocouple in a tube is The thermocouple in a Insulated thermocouple 
inserted in the outlet pipe tube is inserted through wire are inserted 
through a sealed entry a sealed entry through a sealed entry 
and attached to the 
outlet pipe 
Fic. 102B POSITION OF THERMOCOUPLES FOR VERTICALLY ORIENTED WATER CONTAINERS 
Key 
A container 
B External thermocouple 
C Internal thermocouple 
D Outlet pipe 
E Inlet pipe 
F Sealed entry 
Fic. 102 EXAMPLE OF POSITIONS OF THE THERMOCOUPLES 
27 PROVISION FOR EARTHING b) other accessible metal parts of the container 


in contact with the water are permanently and 


This clause of Part 1 is applicable except as follows. reliably Gonnected to the earthing terminal, 


27.1 Addition: 28 SCREWS AND CONNECTIONS 


For Class I water heaters, the sheath of the heating This clause of Part 1 is applicable. 


element shall be permanently and reliably connected 
to the earthing terminal unless, 29 CLEARANCES, CREEPAGE, DISTANCES 


AND SOLID INSULATION 


a) the container is provided with inlet and outlet 
This clause of Part 1 is applicable. 


pipes of metal that are permanently and 
reliably connected to the earthing terminal; 30 RESISTANCE TO HEAT AND FIRE 


and 
This clause of Part 1 is applicable except as follows. 


30.1 Addition: 


The temperature rises occurring during the tests of 19.2, 
19.3 and 19.101 are not taken into account. 


30.2.2 Not applicable. 


31 RESISTANCE TO RUSTING 
This clause of Part 1 is applicable. 


32 RADIATION TOXICITY AND SIMILAR 
HAZARDS 


This clause of Part 1 is applicable. 
101 TESTS 


101.1 Type Tests 


The tests specified in Table 101 shall constitute the 
type tests and shall be carried out on a sample selected 
preferably at random from regular production lot 
(see 5.3). Before commencement of the tests, the water 
heater shall be visually examined and inspected of 
components, parts and their assembly, constructions, 
mechanical hazards, marking provision of suitable 
terminals for supply connections, earthing and the 
effectiveness screws and connection. The external 
surface finish shall be even and free from finishing 
defects. 


101.1.1 Criteria of Acceptance 


Sample shall successfully pass all the type tests for 
proving conformity with the requirements of the 
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Table 101 Schedule of Type Tests 
(Clause 101.1) 


SI No. Tests Ref to 

Clause 
a) (2) (3) 

i) Protection against access to live parts 8 
ii) Power input and current 10 
iii) Heating 11 
iv) Leakage current and electric strength at operating 13 
temperature 
v) Transient overvoltages 14 
vi) Moisture resistance 15 
vii) Leakage current and electric strength 16 
viii) Abnormal operation 19 
ix) Stability and mechanical hazards 20 
x) Mechanical Strength 21 
xi) Construction 22 
xii) Internal wiring 23 
xiii) Components 24 
xiv) Supply connection and external flexible cords 25 
xv) Terminals for external conductors 26 
xvi) Provision for earthing 27 
xvii) Screw and connections 28 
xviii) Clearances, creepage distances and solid 29 
insulation 

xix) Resistance to heat and fire 30 
xx) Resistance to rusting 31 
xxi) Radiation, toxicity and similar hazards 32 


standard. If the sample fails in any of the type tests, the 
testing authority at its discretion, may call for fresh 
samples not exceeding twice the original number and 
subject them again to all tests or to the test (s) in which 
failure (s) had occurred. No failure should be permitted 
in the repeat test (s). 


ANNEXES 


The annexes of Part 1 are applicable except as follows. 


ANNEX A 
(Informative) 
ROUTINE TESTS 


A-101 PRESSURE TEST 


The water container is subjected to a pressure test using 
a fluid. 
When a liquid is used, the pressure is, 


a) for closed water heaters, 0.7 MPa for those 
having a rated pressure not greater than 0.6 MPa, 
and 1.1 times rated pressure for others; 


b) for cistern-fed water heaters and low-pressure 
water heaters, 1.1 times rated pressure; 
c) for open-outlet water heaters, 0.05 MPa;and 
d) for cistern-type water heaters, 0.03 MPa. 
When gas is used, these pressures may be reduced but 
are to be sufficient to reveal leakage. 


Leakage of the fluid is not to occur during the test. 
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ANNEX R 
(Normative) 


SOFTWARE EVALUATION 


Programmable electronic circuits requiring software 
incorporating measures to control the fault/error conditions 
specified in Table R.1 or Table R.2 shall be validated in 
accordance with the requirements in this annex. 
NOTE — Tables R.1 and R.2 are based on Table H.11.12.7 of 
IEC 60730-1 that is, for the purpose of this annex, divided in 


two tables, Table R.1 for general fault/error conditions and Table 
R.2 for specific fault/error conditions. 


R-1 PROGRAMMABLE ELECTRONIC 
CIRCUITS USING SOFTWARE 


Programmable electronic circuits requiring software 
incorporating measures to control the fault/error 
conditions specified in Table R.1 or Table R.2 shall be 
constructed so that the software does not impair 
compliance with the requirements of this standard. 


Compliance is checked by the inspections and tests, 
according to the requirements of this annex, and by 
examination of the documentation as required by this 
annex. 


R-2 REQUIREMENTS 
ARCHITECTURE 


FOR THE 


R-2.1 General 


Programmable electronic circuits requiring software 
incorporating measures to control the fault/error 
conditions specified in Table R.1 or Table R.2 shall 
use measures to control and avoid software-related 
faults/errors in safety-related data and safety-related 
segments of the software. 


Compliance is checked by the inspections and tests in 
R-2.2 to R-3.3.3 inclusive. 


R.2.1.1 Programmable electronic circuits requiring 
software incorporating measures to control the fault/ 
error conditions specified in Table R.2 shall have one 
of the following structures: 


single channel with periodic self-test and 
monitoring (see IS/IEC 60730-1, H.2.16.7); 

dual channel (homogenous) with comparison 
(see ISAEC 60730-1, H.2.16.3); 

dual channel (diverse) with comparison 
(see IS/IEC 60730-1, H.2.16.2). 


NOTE 1 Comparison between dual channel structures may be 
performed by: 


e use of a comparator (see IS/IEC 60730-1 
H.2.18.3), or 

e reciprocal comparison (see IS/IEC 60730-1 
H.2.18.15). 
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Programmable electronic circuits requiring software 
incorporating measures to control the fault/error 
conditions specified in Table R.1 shall have one of the 
following structures: 


single channel with functional test (see 
IS/TEC 60730-1, H.2.16.5); 
single channel with periodic self-test (see 
IS/IEC 60730-1, H.2.16.6); 


dual channel without comparison (see 
ISEC 60730-1, H.2.16.1). 


NOTE 2 — Software structures incorporating measures to 
control the fault/error conditions specified in Table R.2 are also 
acceptable for programmable electronic circuits with functions 
requiring software measures to control the fault/error conditions 
specified in Table R.1. 


Compliance is checked by the inspections and tests of 
the software architecture in R.3.2.2. 


R-2.2 Measures to control faults/errors 


R-2.2.1 When redundant memory with comparison is 
provided on two areas of the same component, the data 
in one area shall be stored in a different format from 
that in the other area (see software diversity, 
IS/TEC 60730-1 H.2.18.19). 


Compliance is checked by inspection of the source 
code. 


R-2.2.2 Programmable electronic circuits with 
functions requiring software incorporating measures to 
control the fault/error conditions specified in Table R.2 
and that use dual channel structures with comparison 
shall have additional fault/error detection means (such 
as periodic functional tests, periodic self tests, or 
independent monitoring) for any fault/errors not 
detected by the comparison. 


R-2.2.3 For programmable electronic circuits with 
functions requiring software incorporating measures to 
control the fault/error conditions specified in Table R. 1 
or Table R.2, means shall be provided for the 
recognition and control of errors in transmissions to 
external safety-related data paths. Such means shall take 
into account errors in data, addressing, transmission 
timing and sequence of protocol. 


Compliance is checked by inspection of the source 
code. 


R-2.2.4 For programmable electronic circuits with 
functions requiring software incorporating measures to 
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control the fault/error conditions specified in Table R.1 Compliance is checked by inspection of the source 
or Table R.2, the programmable electronic circuits shall code. 

incorporate measures to address the fault/errors in 
safety-related segments and data indicated in Table R.1 
or Table R.2 as appropriate. 


R-2.2.5 For programmable electronic circuits with 
functions requiring software incorporating measures to 


Table R.1° General fault/error conditions 


Component ° Fault/error Acceptable measures ™ © Definitions 
See IEC 60730-1 
1 


Central processing 
unit (CPU) 


1.1 


Registers Stuck at Functional test, or 
periodic self-test using either: 
= static memory test, or 


— word protection with single bit redundancy 


E S E 
1.3 


Functional test, or 
Programme Stuck at periodic self-test, or 
independent time-slot monitoring, or 


logical monitoring of the programme sequence 


Interrupt No interrupt Functional test, or 
handling and or too time-slot monitoring H.2.18.10.4 
execution frequent 


interrupt 


Frequency monitoring, or H.2.18.10.1 
time slot monitoring H.2.18.10.4 

Wrong 

frequency 

(for quartz 

synchronized 

clock: 

harmonics/ 


sub-harmonics 


only) 


Invariable All single bit Periodic modified checksum, or H.2.19.3.1 


memory faults multiple checksum, or H.2.19.3.2 


word protection with single bit redundancy H.2.19.8.2 


11 


IS 302-2-21 : 2018 


Table R.1 — (Continued) * 


Component * Fault/error Acceptable measures ™ € Definitions 
See IEC 60730-1 
4.2 


Variable DC fault Periodic static memory test, or H.2.19.6 


memory word protection with single bit redundancy H.2.19.8.2 


4.3 

Addressing Stuck at Word protection with single bit redundancy H.2.19.8.2 
(relevant to including the address 

variable and 

invariable 


memory) 


5 

Internal data Stuck at Word protection with single bit redundancy H.2.19.8.2 
path 

5.1 VOID 


5.2 Addressing Wrong address Word protection with single bit redundancy including the H.2.19.8.2 
address 
6 
External Hamming Word protection with multi-bit redundancy, or CRC — 
communication distance 3 single word , or 


6.1 VOID 
6.2 VOID 


6.3 Wrong point in Time-slot monitoring, or 
Timing time scheduled transmission 
Time-slot and logical monitoring, or 
comparison of redundant communication channels by 
either: 
— reciprocal comparison 
— independent hardware comparator 
Wrong Logical monitoring, or 
sequence time-slot monitoring, or 
scheduled transmission 
7 


transfer redundancy, or 


protocol test 


Input/output Fault Plausibility check H.2.18.13 


periphery conditions 
specified in 


19.11.2 
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Component * 


7.1 VOID 

7.2 

Analog I/O 
7.2.1 A/D- and 


D/A- convertor 


7.2.2 Analog 
multiplexer 


9 
Custom 


chips d 
e.g. ASIC, 
GAL, gate 


array 


Fault/error 


Fault conditions 
specified 
in 19.11.2 


Wrong addressing 


Any output 


outside the 


static and 
dynamic 
functional 


specification 


Table R.1 — (Concluded)® 


Acceptable measures ™ € 


Plausibility check 


Plausibility check 
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Definitions 
See IEC 60730-1 


H.2.18.13 
H.2.18.13 


Periodic self test 


NOTE — A Stuck-at fault model denotes a fault model representing an open circuit or a non-varying signal level. A DC 


fault model denotes a stuck-at fault model incorporating short circuits between signal lines. 


a For fault/error assessment, some components are divided into their sub-functions. 


For each sub-function in the table, the Table R.2 measure will cover the software fault/error. 


Where more than one measure is given for a sub-function, these are alternatives. 


To be divided as necessary by the manufacturer into sub-functions. 


Table R.1 is applied according to the requirements of R.1 to R.2.2.9 inclusive. 
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Table R.2° — Specific fault/error conditions 


Component ° Fault/error Acceptable measures ™ ° Definitions 
See IEC 60730-1 
1 


Central Processing 
Unit (CPU) 


1.1 DC fault Comparison of redundant CPUs by either: 
Registers — reciprocal comparison 
— independent hardware comparator, or 
internal error detection, or 
redundant memory with comparison, or 
periodic self-tests using either 
—  walkpat memory test 
— Abraham test 
— transparent GALPAT test; or 
word protection with multi-bit redundancy, or 
static memory test and 


word protection with single bit redundancy 


1.2 
Instruction Wrong Comparison of redundant CPUs by either: 
decoding and decoding — reciprocal comparison 
execution and execution — independent hardware comparator, or 
internal error detection, or 
periodic self-test using equivalence class test 
1.3 DC fault Periodic self-test and monitoring using either: 
Programme counter — independent time-slot and logical monitoring 
— internal error detection, or 
comparison of redundant functional channels by either: 
— reciprocal comparison 
— independent hardware comparator 
1.4 
Addressing DC fault Comparison of redundant CPUs by either: 
— reciprocal comparison 
— independent hardware comparator; or 
internal error detection; or 


periodic self-test using 


— a testing pattern of the address lines; or 
— a full bus redundancy 


—a multi bus parity including the address 


1.5 


Data paths DC fault Comparison of redundant CPUs by either: 


instruction and — reciprocal comparison, or H.2.18.15 

decoding execution — independent hardware comparator, or H.2.18.3 
— internal error detection, or H.2.18.9 
— periodic self-test using a testing pattern, or H.2.16.7 
— data redundancy, or H.2.18.2.1 
— multi-bit bus parity H.2.18.1.2 
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Table R.2 — (Continued) * 


Component * Fault/error Acceptable measures ° Definitions 
See IEC 60730-1 


No interrupt Comparison of redundant functional 
reer handling 


5 or too channels by either 
and execution 


frequent — reciprocal comparison, H.2.18.15 
interrupt — independent hardware comparator, or H.2.18.3 


related to — independent time-slot and logical monitoring H.2.18.10.3 
different sources 


Wrong Frequency monitoring, or H.2.18.10.1 
frequency time-slot monitoring, or H.2.18.10.4 
(for quartz comparison of redundant functional channels 

synchronized by either: 

clock: — reciprocal comparison H.2.18.15 
harmonics/ — independent hardware comparator 


subharmonics 


Comparison of redundant CPUs by either: 
Invariable coverage of — reciprocal comparison 
memory all information — independent hardware comparator, or 
errors redundant memory with comparison, or 
periodic cyclic redundancy check, either 
— single word 
- double word, or 
word protection with multi-bit redundancy 
4.2 DC fault Comparison of redundant CPUs by either: 
Variable and dynamic — reciprocal comparison 
memory cross links — independent hardware comparator, or 
redundant memory with comparison, or 
periodic self tests using either: 
—  walkpat memory test 
— Abrahan test 
— transparent GALPAT test, or 


word protection with multi-bit redundancy 


4.3 DC fault Comparison of redundant CPUs by either: 


Addressing — reciprocal comparison, or H.2.18.15 


(relevant to — independent hardware comparator, or H.2.18.3 
variable and full bus redundancy H.2.18.1.1 
invariable testing pattern, or H.2.18.22 
memory) periodic cyclic redundancy check, either: 
— single word H.2.19.4.1 
— double word, or H.2.19.4.2 


word protection with multi-bit redundancy including H.2.19.8.1 
the address 
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Table R.2 — (Continued) * 


Component * Fault/error Acceptable measures ™ ° Definitions 
See IEC 60730-1 


5 
Internal data path 


5.1 Data DC fault Comparison of redundant CPUs by either 
— reciprocal comparison 
— independent hardware comparator, or 
word protection with multi-bit redundancy 
including the address, or data redundancy, or 
testing pattern, or 
protocol test 
5.2 Addressing Wrong Comparison of redundant CPUs by: 
address and — reciprocal comparison 
multiple — independent hardware comparator, or 


addressing word protection with multi-bit redundancy, including the 
address, or full bus redundancy; or testing pattern 
including the address 


6 
External 
communication 


Hamming distance | CRC — double word, or H.2.19.4.2 
4 


data redundancy or H.2.18.2.1 


comparison of redundant functional channels by either: 
— reciprocal comparison H.2.18.15 


— independent hardware comparator H.2.18.3 


6.2 Wrong Word protection with multi-bit redundancy, H.2.19.8.1 


Addressing address including the address, or CRC single word H.2.19.4.1 


including the addresses, or 

transfer redundancy or H.2.18.2.2 

protocol test H.2.18.14 
Wrong and CRC — double word, including the address, or H.2.19.4.2 
multiple full bus redundancy of data and address, or H.2.18.1.1 


addressing comparison of redundant communication channels by 
either: 


— reciprocal comparison H.2.18.15 


— independent hardware comparator H.2.18.3 


6.3 Wrong point in Time-slot monitoring, or H.2.18.10.4 
Timing time scheduled transmission H.2.18.18 


7 
Input/output 
periphery 
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Table R.2 — (Concluded) * 


Component * Fault/error Acceptable measures ™ ° Definitions 
See 
IEC 60730-1 


7A Fault Comparison of redundant CPUs by either: 
Digital I/O conditions — reciprocal comparison 
specified in — independent hardware comparator, or 
19.11.2 input comparison, or 
multiple parallel outputs, or 
output verification, or 
testing pattern, or 
code safety 


7.2 
Analog I/O 


7.2.1 A/D- and Fault conditions 


D/A- convertor 
specified Comparison of redundant CPUs by either: 


in 19.11.2 — reciprocal comparison 


— independent hardware comparator, or 
input comparison, or 

multiple parallel outputs, or 

output verification, or 


testing pattern 


7.2.2 Analog Wrong addressing | Comparison of redundant CPUs by either: 
multiplexer — reciprocal comparison 


— independent hardware comparator, or 


input comparison or 


testing pattern 


Monitoring Any output outside | Tested monitoring, or H.2.18.21 
the static and 
dynamic functional 
specification 


devices and redundant monitoring and comparison, or H.2.18.17 


comparators error recognizing means H.2.18.6 


9 


Custom Any output Periodic self-test and monitoring, or 
chips d outside the dual channel (diverse) with comparison, or 
e.g. ASIC static and error recognizing means 

g. 3 


GAL, gate dynamic 
functional 


array 
specification 


NOTE — A DC fault model denotes a stuck-at fault model incorporating short circuits between signal lines. 


For fault/error assessment, some components are divided into their sub-functions. 
For each sub-function in the table, the software measure will cover the Table R.1 fault/error. 
Where more than one measure is given for a sub-function, these are alternatives. 


To be divided as necessary by the manufacturer into sub-functions. 


Table R.2 is applied according to the requirements of R.1 to R.2.2.9 inclusive, only if required by a part 2. 
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control the fault/error conditions specified in Table R.1 
or Table R.2, detection ofa fault/error shall occur before 
compliance with 19 and 24.102.1 is impaired. 


R-2.2.6 The software and safety-related hardware 
under its control shall be initialized and shall terminate 
before compliance with Clause 19, 22.105 and 22.108 
is impaired. 


R-2.2.7 Where labels are used for memory locations, 
these labels shall be unique. 


Compliance is checked by inspection of the source 
code. 


R-2.2.8 The software shall be protected from user 
alteration of safety-related segments and data. 


Compliance is checked by inspection of the source 
code. 


R-2.2.9 The software and safety-related hardware under 
its control shall be initialized and shall terminate before 
compliance with 19 and 24.102.1 is impaired. 


Compliance is checked by testing of the source code. 


R-3 MEASURES TO AVOID ERRORS 
R-3.1 General 


For programmable electronic circuits with functions 
requiring software incorporating measures to control 
the fault/error conditions specified in Table R.1 or 
Table R.2, the following measures to avoid systematic 
faults in the software shall be applied. 


Software that incorporates measures used to control 
the fault/error conditions specified in Table R.2 is 
inherently acceptable for software required to control 
the fault/error conditions specified in Table R.1. 


NOTE — The content of these requirements is extracted from 
IEC 61508-3 and adapted to the needs of this Standard. 


R-3.2 Specification 
R-3.2.1 Software safety requirements 


The specification of the software safety requirements 
shall include: 


a description of each safety related function 
to be implemented, including its response 
time(s): 

e functions related to the application including 
their related software faults required to be 
controlled; 


e functions related to the detection, annunciation 
and management of software or hardware 
faults; 

a description of interfaces between software 
and hardware; 


a description of interfaces between any safety 
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and non-safety related functions; 

a description of any compiler used to generate 
the object code from the source code, 
including details of any compiler switch 
settings used such as library function options, 
memory model, optimization, SRAM details, 
clock rate and chip details; 

a description of any linker used to link the 
object code to executable library routines. 


Compliance is checked by inspection of the 
documentation and as specified in R-3.2.2.2. 


NOTE — Examples of some techniques/measures to meet these 
requirements can be found in Table R.3. 


Table R-3 — Semi-formal methods 


Technique / Measure Informative references 


Semi-formal methods 


Logical/functional block 
diagrams 


Sequence diagrams 


Finite state machines/state 
transition diagrams 
Decision/truth tables 


IS/IEC 61508-7, B.2.3.2 
IS/IEC 61508-7, C.6.1 


R-3.2.2 Software architecture 


R-3.2.2.1 The specification of the software architecture 
shall include the following aspects: 


techniques and measures to control software 
faults/errors (refer to R-2.2); 


interactions between hardware and software; 


partitioning into modules and their allocation 
to the specified safety functions; 


hierarchy and call structure of the modules 
(control flow); 


interrupt handling; 
data flow and restrictions on data access; 
architecture and storage of data; 
time-based dependencies of sequences and 
data. 
Compliance is checked by inspection of the 
documentation and as specified in R-3.2.2.2. 
NOTE — Examples of some techniques/measures to meet these 
requirements can be found in Table R.4. 
R-3.2.2.2 The architecture specification shall be 
validated against the specification of the software 
safety requirements by static analysis. 


NOTE Example methods for static analysis are: 
° control flow analysis; (IS/IEC 61508-7, C.5.9); 
° data flow analysis; (IS/IEC 61508-7, C.5.10); 


e — _walk-throughs/design reviews. (IS/IEC 61508-7, C.5.16). 
R-3.2.3 Module design and coding 


R-3.2.3.1 Based on the architecture design, software 


shall be suitably refined into modules. Software module 
design and coding shall be implemented in a way that 
is traceable to the software architecture and 
requirements. 


Compliance is checked by R-3.2.3.3 and by inspection 
of the documentation. 


NOTE 1 — The use of computer aided design tools is accepted. 


NOTE 2 — Defensive programming (IEC 61508-7, Subclause 
C.2.5) is recommended (e.g. range checks, check for division 
by 0, plausibility checks). 


NOTE 3 — The module design shall specify: 


e — function(s), 
° interfaces to other modules, 
° data. 


NOTE 4 Examples of some techniques/measures to meet these 
requirements can be found in Table R.5. 


R-3.2.3.2 Software code shall be structured. 


Compliance is checked by R-3.2.3.3 and by inspection 
of the documentation. 


NOTE 1 Structural complexity can be minimized by applying 
the following principles: 


e keep the number of possible paths through a software 
module small, and the relation between the input and 
output parameters as simple as possible; 

e avoid complicated branching and, in particular, avoid 
unconditional jumps (GOTO) in higher level languages; 

e where possible, relate loop constraints and branching 
to input parameters; 
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e avoid using complex calculations as the basis of 
branching and loop decisions. 
NOTE 2 — Examples of some techniques/measures to meet 
these requirements can be found in Table R.6. 
R-3.2.3.3 Coded software shall be validated against 
the module specification by static analysis. The module 
specification shall be validated against the architecture 
specification by static analysis. 


R-3.3.3 Software validation 


The software shall be validated with reference to the 
requirements of the software safety requirements 
specification. 


NOTE 1 — Validation is confirmation by examination and 
provision of objective evidence that the particular requirements 
for a specific intended use are fulfilled. Therefore, for example, 
software validation means confirming by examination and 
provision of objective evidence that the software satisfies the 
software safety requirements specification. 


Compliance is checked by simulation of 
— input signals present during normal operation, 
— anticipated occurrences, 
— undesired conditions requiring system action. 
Test cases, test data and test results shall be reported. 


NOTE 2 — Examples of some techniques/measures to meet 
these requirements can be found in Table R.7. 


Table R.4 — Software architecture specification 


Technique / Measure 
Fault detection and diagnosis 


Semi-formal methods: 

e = Logic/function block diagrams 

e Sequence diagrams 

e Finite state machines / state transition diagrams 


e Data flow diagrams 


Informative references 


IS/IEC 61508-7, C.3.1 


IS/IEC 61508-7, B.2.3.2 
IS/IEC 61508-7, C.2.2 


Table R.5 — Module design specification 


Technique / Measure 


Informative references 


Limited size of software modules 


Information hiding / encapsulation 


IS/IEC 61508-7, C.2.9 
IS/IEC 61508-7, 


One entry / one exit point in subroutines and functions 


Fully defined interface 


IS/IEC 61508-7, 
IS/IEC 61508-7, 


Semi-formal methods: 


e  Logic/function block diagrams 
e Sequence diagrams 
e Finite state machines / state transition diagrams 


e Data flow diagrams 


IS/IEC 61508-7, 
IS/IEC 61508-7, 
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Table R.6 — Design and coding standards 


Technique / Measure 


Informative references 


languages 


allocation of memory. 


Use of coding standard (see NOTE) IS/IEC 61508-7, C.2.6.2 
No use of dynamic objects and variables (see NOTE) IS/IEC 61508-7, C.2.6.3 
Limited use of interrupts IS/IEC 61508-7, C.2.6.5 
Limited use of pointers IS/IEC 61508-7, C.2.6.6 
Limited use of recursion IS/IEC 61508-7, C.2.6.7 
No unconditional jumps in programs in higher level | IS/IEC 61508-7, C.2.6.2 


NOTE — Dynamic objects and/or variables are allowed if a compiler is used which ensures that sufficient memory for all 
dynamic objects and/or variables will be allocated before runtime, or which inserts runtime checks for the correct online 


Table R.7 — Software safety validation 


Technique / Measure 


Informative references 


Functional and black-box testing: 


IS/IEC 61508-7, B.5.1, B.5.2 


e Boundary value analysis IS/IEC 61508-7, C.5.4 
e Process simulation IS/IEC 61508-7, C.5.18 
Simulation, modelling: 

e Finite state machines IS/IEC 61508-7, B.2.3.2 
e Performance modelling IS/IEC 61508-7, C.5.20 


NOTE 3 — Testing should be the main validation method for software; modelling may be used to supplement the validation activities. 


ANNEX AA 
(Normative) 


ADDITIONAL REQUIREMENT FOR IMMERSION HEATER UNITS INTENDED FOR THE 
INSTALLATION IN HEAT EXCHANGE CLOSED WATER HEATERS 


The following requirements of this standard are for 
immersion heater units intended for the installation in a 
heat exchange closed water heater. Other subclauses of 
this standard not mentioned in this annex are applicable. 
Where ‘water heater’ is written, the requirement applies 
for ‘immersion heater units’ of this annex. 
NOTE — Water storage tanks without an integrated heat 
exchanger can be retrofitted with an immersion heater unit if 
the retrofitting is allowedby the manufacturer of the container. 
In this case, the manufacturer needs to specify the acceptable 


immersion heater units in the instruction for installation of the 
water storage tank. 


AA.3 TERMS AND DEFINITIONS 
AA.3.1.9 Replacement: 


normal operation 


operation ofthe immersion heater unit after installation 
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in accordance with the instructions in the smallest tank 
specified, the tank being thermally insulated and filled 
with water 


NOTE 101— Accessible parts of the immersion heater unit are 
not thermally insulated. 


AA.3.201 Immersion Heater Unit 


appliance consisting of heating element and controls 
in a single unit to control the temperature in both normal 
and abnormal conditions and intended to be retrofitted 
to a heat exchange closed water heater 


AA-5 GENERAL CONDITIONS FOR THE TESTS 
AA.5.2 Addition: 


Additional immersion heater units may be required for 
the tests of 19 and 22.102. 


AA.5.3 Addition: 


The test is to be carried out in a water tank according 
to the instructions of the manufacturer of the immersion 
heater unit. 


NOTE — Several tests for different mounting positions 
(vertically from the top or bottom, horizontally) can be required. 


AA.7 MARKING AND INSTRUCTIONS 
AA.7.1 Replacement: 


Immersion heater units for multiple supply shall be marked 
with their rated power input for each supply circuit. 


Immersion heater units shall be marked with the rated 
pressure. The rated pressure shall not be lower than 
0.6 MPa. 


AA.7.12.1 Replacement: 
The installation instruction shall include the following: 


a) 


type, the volume or volume range, and 
dimensions of the tank in which the immersion 
heater unit can be installed; 


b) the positioning of the immersion heater unit 
within the tank; 

c) astatement that the installer must check that 
there is water in the tank before the immersion 
heater unit is switched on the first time; 

d) that a pressure-relief device is to be installed 
in the installation, unless it is not already part 
of the water tank installation; 

e) the type and properties of the pressure-relief 
device and how to install it; 

f) that a discharge pipe connected to the pressure 


relief device shall be installed with a steady 
downward inclination in a frost-free environment. 


The instructions for immersion heater units for water 
tanks with an incorporated heat exchanger shall include 
instructions for the installation of thermal controls and 
their temperature setting in order to prevent the thermal 
cut-out from operating due to the heat of the heat 
exchanger. 


AA.19 ABNORMAL OPERATION 
AA.19.1 Addition: 


For immersion heater units, the tests of 19.2 and 19.3 
are applicable. 


AA.19.13 Addition: 


During the test, the immersion heater unit shall not show 
any leakage. 


AA.22 CONSTRUCTION 
AA.22.47 Replacement: 


The immersion heater units shall withstand the water 
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pressure occurring in normal use. 


Compliance is checked by the following: The 
immersion heater units are exposed to a water pressure 
which is twice as high as the rated pressure. 


The pressure is raised to the specified value at a rate of 
0.13 MPa/s and maintained at this value for 5 min. 


No water is allowed to leak and no permanent 
deformation of the parts of the immersion heater unit 
intended to withstand the water pressure is allowed to 
an extent which would impair conformity to this 
standard. 


AA.22.101 Replacement: 


The rated pressure of immersion heater units intended 
to be exposed directly to the water main shall be at 
least 0.6 MPa. 


AA.22.111 Replacement: 
Void. 


AA.22.112 Immersion heater units shall be supplied 
with a seal or similar means to ensure that there is no 
leakage from the tank after installation. 


Compliance is checked by inspection during the test of 11. 


AA.22.113 The immersion heater unit shall not be able 
to be removed from the tank without the aid of a tool. 


Compliance is checked by inspection. 


The cover of the compartment containing the supply 
terminals shall be prevented from rotating by more than 
180° with respect to the fixed part of the immersion 
heater unit. 


Compliance is checked by inspection. 
AA.24 COMPONENTS 
AA.24.102 Replacement: 


The thermal cut-out shall operate before the water 
temperature exceeds 99 °C and the water temperature 
shall not exceed the opening temperature of the thermal 
cut-out by more than 20 K. 


Compliance is checked by the following test. 


The operating temperature of the thermal cut-out is 
measured with a thermo element that is attached to the 
sensor element or arranged in its close vicinity. 


If the tank is in a horizontal position, the water 
temperature is measured at the most unfavourable 
position by a thermocouple positioned 50 mm below 
the upper inner surface of the container. 


The immersion heater unit is operated at 1.15 times its 
rated power input with the thermostat short-circuited 
but under normal operation conditions and with the 
output valve of the tank closed. 


The test is continued until the thermal cut-out operates. 


(Continued from second cover) 


When a particular subclause of Part 1 is not mentioned in this Part 2, that subclause applies as far as is reasonable. 
When this standard states ‘addition’, ‘modification’ or ‘replacement’, the relevant text in Part 1 is to be adapted 
accordingly. 


NOTES The following numbering system is used: 


a) Subclauses, tables and figures that are numbered starting from 101 are additional to those in Part 1; 


b) Unless notes are in a new subclause or involve notes in Part 1, they are numbered starting from 101, including those in a 
replaced clause or subclause; 


c) Additional annexes are lettered AA, BB, etc. 


This standard is based on IEC 60335-2-21 : 2012 Household & similar electrical appliances-safety — 
Part 2-21 : Particular requirements for storage water heaters. As this standard refers to IS 302-1, the differences 
of IS 302-1 from IEC 60335-1 shall apply. 


The principal change in this revision is as follows (minor changes are not listed): 


added requirements for immersion heater units (fixed immersion heaters). 
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